Removable data storage medium, medical device and method for operating a removable data storage medium

CROSS-REFERENCE TO RELATED APPLICATION

The present application is a continuation of PCT/EP2015/000009 filed on Jan. 6, 2015, which is based upon and claims the benefit to DE 10 2014 200 533.7 filed on Jan. 14, 2014, the entire contents of each of which are incorporated herein by reference.

BACKGROUND

Field

The present application relates to a removable data storage medium having a serial interface, a non-volatile storage medium and a memory controller controlling the data transmission between the serial interface and the non-volatile storage medium. More particularly, the present application relates to a medical device, comprising a device identification feature and a serial interface for exchanging data with a removable data storage medium. The present application further relates to a method for operating a removable data storage medium having a serial interface, a non-volatile storage medium and a memory controller controlling the data transmission between the serial interface and the non-volatile storage medium. Finally, the present application relates to a medical system, comprising a removable data storage medium and a medical device.

Prior Art

Removable storage media, for example USB memory sticks, are generally known.

In a medical environment, information is exchanged between individual medical devices, but also between medical devices and otherwise used computers, with the help of removable data storage media.

However, conventional removable data storage media do not always reach the desired requirements for quality, data transmission speed and data security in a medical environment. The consequences are incomplete data transmission or data loss.

Moreover, there is a risk that malware is transmitted from the freely accessible computer to the medical devices via a removable data storage medium, which is used both on medical devices as well as on freely accessible computers.

SUMMARY

It is an object to provide a removable data storage medium, the data communication with medical devices of which is improved with respect to data security. It is also an object to provide a medical device, the data communication with removable data storage media of which is improved with respect to data security. Moreover, it is an object to provide a method for operating a removable data storage medium, which enables secure data communication between the removable data storage medium and medical devices. Finally, it is an object to provide a medical system, in which data communication takes place with enhanced data security.

Such objects are solved by a removable data storage medium having a serial interface, a non-volatile storage medium and a memory controller controlling the data transmission between the serial interface and the non-volatile storage medium, wherein the removable data storage medium is further developed in that a receiving unit and a write protection unit, which can be provided in the memory controller, being present, wherein the receiving unit is configured to receive a device identification feature from a medical device that can be connected to the removable data storage medium, and the write protection unit is configured to compare the device identification feature with a predetermined internal criterion, and, if the device identification feature complies with this criterion, to permit read and write access to the non-volatile storage medium and, if the device identification feature does not comply with the criterion, to limit access to the non-volatile storage medium to read access.

The removable data storage medium can be a mass storage, the non-volatile storage medium of which is a flash storage, for example an EEPROM.

The removable data storage medium can be configured in a case when it is not in the position to determine a device identification feature to treat this case such that the device identification feature does not meet the criterion.

With such removable data storage medium, a data export from a medical device to any computer system is possible. However, a data import and export is only possible between such medical devices, which were authenticated based on their device identification feature by the removed data storage medium for this type of data access. In other words, this means that the device identification features of the concerned medical devices must have respectively complied with the predetermined internal criterion of the removable data storage medium before they receive full access to the removable data storage medium. The removable data storage medium thus classifies the medical devices based on their device identification features as trustworthy and permits an unhindered data exchange between the thusly qualified appliances.

It is thus possible that data is exported from a medical device to any computer system in order to render or further process them there. Conversely, data from this computer system, which was not identified as a qualified medical system, is not transmitted to medical devices. The removable data storage medium only gives the non-qualified computer system read access and no read and write access to the non-volatile storage medium. Thus, the non-qualified computer system is not able to transmit data to the medical devices, which increases the data security in such an environment. Neither the data saved on the removable data storage medium nor the data present on the medical device can be infected with malware.

For example, a predetermined code saved in the medical device, a serial number, a certain hardware equipment, information regarding the manufacturer of the medical device, for example an open or encrypted manufacturer identification number or a manufacturer code, a type or version number of the device, of the hardware and/or software equipment etc. can be used as the device identification feature.

It is possible to form the device identification feature based on individual or several of the named data, if applicable based on a specific determined combination of different data. In other words, the device identification feature can be made up of several characteristics. The device identification feature serves to identify the medical device. It is thereby less important to uniquely identify a medical device as such than to assign it to a class of trustworthy medical devices, between which an unrestricted data exchange should be possible.

For this purpose, the device identification feature is compared with a predetermined criterion present on the removable data storage medium. A unique comparison can be performed so that the removable data storage medium only communicates for example with a certain device with full access (read and write mode). However, the removable data storage medium can identify a group of medical devices based on the comparison with the predetermined criterion, wherein each device in this group is granted full access. For example, devices as of a certain serial number, as of a certain year of manufacture or devices from a certain manufacturer can each be granted full access, i.e. read and write access, to the removable data storage medium.

According to one embodiment, the removable data storage medium can be further developed in that the receiving unit is configured to receive the device identification feature via a wireless data link. For example, the receiving unit can comprise an RFID transponder. According to further embodiments, the receiving unit can comprise a Bluetooth and/or a NFC (New Field Communication) transponder.

The identification of the medical device via a wireless data link is advantageous because this process can take place before the data storage medium is connected to the concerned medical device via the serial interface. Thus, the subsequent connection establishment between the removable data storage medium and the medical device does not result in a further delay. Moreover, it is possible that the removable data storage medium outputs, for example, an optical or acoustic signal, which notifies the user that a data link with the concerned appliance is possible with full access or in read mode only. The user is thus already able to decide how to proceed before establishing the actual data link.

In a further embodiment, the removable data storage medium can be enhanced in that the receiving unit is configured to receive data via an optical data link, such as a photodiode.

According to a further embodiment, the removable data storage medium can be advantageously enhanced in that the receiving unit is mechanically encoded and configured to interact with a complementary mechanically encoded transmitting unit on the medical device that can be connected to the removable data storage medium.

The used receiving unit, i.e. for example the photodiode or the mechanically encoded receiving unit, can be provided in direct proximity of the serial interface on the removable storage unit. It is thus possible that the receiving unit interacts with the corresponding transmitting unit of the medical device at the moment when the removable data storage medium is also connected to the serial interface of the medical device.

The requirements for authentication and subsequent data transmission can be advantageously established with a handle, which simplifies the handling of the removable data storage medium.

According to a further embodiment, the removable data storage medium can be configured as a USB memory stick, wherein a USB port is provided as the serial interface. Such a removable data storage medium can have a housing, in which the non-volatile storage medium, the memory controller, the write protection unit and the receiving unit are all arranged together. Such a removable data storage medium is compact and robust and thus suitable for use in a medical environment.

An object is also solved by a medical device, comprising a device identification feature and a serial interface for exchanging data with a removable data storage medium, wherein the medical device is enhanced in that it comprises a transmitting unit, which is configured to transmit the device identification feature to the removable data storage medium.

The medical device is advantageously configured for secure data communication with a removable data storage medium according to one or more of the named embodiments. The aspects mentioned with respect to the removable data storage medium thus also apply analogously to the medical device.

According to a further embodiment, the medical device can be enhanced in that the transmitting unit is configured to send the device identification feature to the removable data storage medium via a wireless data link. The transmitting unit can comprise an RFID tag, in which the device identification feature is stored in the form of a code identifying the medical device.

In one embodiment, the medical device is configured so that the transmitting unit comprises a light emitter, such as, an IR light-emitting diode. It is also possible to advantageously further develop the medical device such that the transmitting unit is mechanically encoded and configured to interact with a mechanically encoded receiving unit that can be connected to the medical device.

The same or similar advantages as those already mentioned with respect to the removable data storage medium also apply in the same or a similar way to the medical device according to one or more of the named embodiments. These are not repeated in order to prevent the item from being reintroduced.

An object according is also solved by a method for operating a removable data storage medium having a serial interface, a non-volatile storage medium and a memory controller controlling the data transmission between the serial interface and the non-volatile storage medium, wherein the method can be enhanced in that a write protection unit and a receiving unit are provided and the method comprises the following steps:

connecting the serial interface of the removable data storage medium having a serial interface of a medical device,

receiving a device identification feature from the medical device on the receiving unit,

comparing the device identification feature with a predetermined internal reference criterion, and

setting read and write access to the non-volatile storage medium of the removable data storage medium if the device identification feature complies with the criterion and limit of access to the non-volatile storage medium to read access if the device identification feature does not comply with the criterion.

For the method, it does not matter which of the two steps “connecting the serial interface” and “receiving the device identification feature” is performed first. It is also possible that the two steps take place more or less simultaneously. If the removable data storage medium is not able to identify a device identification feature, then it is treated like a case when the device identification feature does not comply with the criterion.

The method can be advantageously further developed in that the device identification feature is received via a wireless data link, wherein the device identification feature is received by an RFID transponder and/or by a receiving unit, such as a photodiode, configured for an optical data link.

According to a further embodiment, the method can be enhanced in that the device identification feature is received at a mechanically encoded receiving unit by mechanical interaction with a complementary mechanically encoded transmitting unit.

The same or similar advantages as those already mentioned in terms of the removable data storage medium also apply to the method for operating a removable data storage medium.

Finally, an object is solved by a medical system, comprising a removable data storage medium according to one or more embodiments and a medical device according to one or more of the named embodiments.

In the medical system, the data communication with the help of removable data storage media is considerably securer than in conventional systems. However, the restrictions for data transmission are low since, for example, data from the medical devices can be exported to further computer systems in an unrestricted or unlimited manner. Otherwise, same or similar advantages as those already mentioned in terms of the removable data storage medium also apply to the medical system.

Further features will become apparent from the description of embodiments together with the claims and the included drawings. Embodiments can fulfill individual features or a combination of several features.

BRIEF DESCRIPTION OF THE DRAWINGS

The embodiments will be described below without restricting the general inventive idea using exemplary embodiments with reference to the drawings, and for any details which are not explained further in the text express reference is made to the drawings. They show in:

<figref idref="DRAWINGS">FIGS. 1 to 3</figref> illustrate a medical system with a removable data storage medium and a medical device, each in a schematic representation and according to different exemplary embodiments,

<figref idref="DRAWINGS">FIG. 4</figref> illustrates a schematic flow diagram of a method for operating a removable data storage medium, according to an exemplary embodiment,

<figref idref="DRAWINGS">FIG. 5<i>a </i></figref>illustrates a schematically shown communication schema in a medical system, comprising a removable data storage medium according to the prior art and

<figref idref="DRAWINGS">FIG. 5<i>b </i></figref>illustrate a schematically drawn communication schema in a medical system, comprising a removable data storage medium according to one exemplary embodiment.

In the drawings, same or similar elements and/or parts are provided with the same reference numbers in order to prevent the item from needing to be reintroduced.

DETAILED DESCRIPTION

<figref idref="DRAWINGS">FIG. 1</figref> shows in a schematic representation a medical system <b>2</b><i>a</i>, comprising a removable data storage medium <b>4</b> and a medical device <b>6</b>.

The removable data storage medium <b>4</b> comprises a serial interface <b>9</b><i>a</i>, such as a USB port, which is provided within the USB plug <b>8</b>. Moreover, the removable data storage medium <b>4</b> comprises a non-volatile storage medium <b>10</b>, for example a flash memory, like an EEPROM. A memory controller <b>12</b>, which controls the data transmission between the serial interface <b>9</b><i>a </i>and the non-volatile storage medium <b>10</b>, is located between the non-volatile storage medium <b>10</b> and the serial interface <b>9</b><i>a </i>present within the USB plug <b>8</b>. The non-volatile storage medium <b>10</b>, the memory controller <b>12</b> and the serial interface <b>9</b><i>a </i>are interconnected through suitable data lines. This is shown schematically in <figref idref="DRAWINGS">FIG. 1</figref> by lines.

The USB plug <b>8</b>, such as a standard USB plug, represents the physical interface of the removable data storage medium <b>4</b> to a host computer, such as a medical device <b>6</b>. For the data communication with the removable data storage medium <b>4</b>, the medical device <b>6</b> comprises a corresponding USB socket <b>14</b>.

The medical device <b>6</b> is, for example, a video management control unit, which is used in a medical environment, such as in an intensive care environment, such as for example an operating theater or room. The medical device <b>6</b> can also be any other medical device, for example a therapeutic or diagnostic device, which serves to generate image data, which can be queried via an internal serial interface <b>9</b><i>b </i>connected to the USB socket <b>14</b>. For this purpose, the medical device <b>6</b> comprises the further components necessary, which are not shown in <figref idref="DRAWINGS">FIG. 1</figref>. The above explanations also apply to the following exemplary embodiments.

The removable data storage medium <b>4</b> also comprises further components not shown in <figref idref="DRAWINGS">FIG. 1</figref>, which are only left out for reasons of simplification. For example, the removable data storage medium <b>4</b> comprises an oscillator, a LED indicating the operating state and a printed circuit board, which receives the non-volatile storage medium, the memory controller and the other named electronic components. These explanations also apply to all exemplary embodiments.

The removable data storage medium <b>4</b> comprises a receiving unit <b>16</b>, which is configured to receive a device identification feature of the medical device <b>6</b> that can be connected to the removable data storage medium <b>4</b>. For this purpose, the receiving unit <b>16</b> is configured to receive data via a wireless data link <b>19</b>. According to the exemplary embodiment shown in <figref idref="DRAWINGS">FIG. 1</figref>, the receiving unit <b>16</b> is an RFID transponder <b>18</b>. The receiving unit <b>16</b> of the removable data storage medium <b>4</b> communicates with a transmitting unit <b>20</b> of the medical device <b>6</b> via the wireless data link <b>19</b>. In the shown exemplary embodiment, the transmitting unit <b>20</b> of the medical device <b>6</b> is an RFID tag <b>22</b>.

The RFID tag <b>22</b> comprises a device identification feature in the form of a code identifying the medical device <b>6</b>. This can be stored in the RFID tag <b>22</b>. The code identifying the medical device <b>6</b> can be for example a serial number, a type designation, a manufacturer designation, a manufacturer identification number, a manufacturer code, a hardware or software configuration, a version number, etc.

In that the removable data storage medium <b>4</b> reads the device identification feature of the medical device <b>6</b> using the RFID transponder <b>18</b>, the removable data storage medium <b>4</b> is enabled to compare this device identification feature, for example a manufacturer designation or a serial number, with a predetermined internal criterion. For this purpose, the removable data storage medium <b>4</b> comprises a write protection unit <b>13</b>.

The write protection unit <b>13</b> can be implemented both as hardware and software. The write protection unit <b>13</b> can be implemented as part of the memory controller <b>12</b>.

The write protection unit <b>13</b> determines whether or not the queried device identification feature of the medical device <b>6</b> complies with the internal criterion of the removable data storage medium <b>4</b>. In other words, the removable data storage medium <b>4</b> determines whether or not the medical device <b>6</b> is qualified. The removable data storage medium <b>4</b> ensures full access (i.e. read and write access) to the non-volatile memory <b>10</b> for qualified medical devices <b>6</b>, while non-qualified appliances <b>6</b> are only granted read access to the non-volatile storage medium <b>10</b>.

The internal criterion is, for example, a criterion to be clearly met. In other words, the data storage medium <b>4</b> is configured to only communicate with medical devices <b>6</b> from a certain manufacturer or with medical devices <b>6</b> of a certain series.

According to a further exemplary embodiment, the write protection unit <b>13</b> defines the criterion such that a minimum requirement must be met in order to ensure read and write access. For example, a minimum hardware or software version, version number, appliance number, year of manufacture, etc. may need to be met.

It is also possible that an internal list of potential criteria that may need to be cumulatively met is present in the removable data storage medium <b>4</b> so that the device identification feature also complies with the predetermined internal criterion when one or more of the queried criteria, for example a manufacturer designation and/or a serial number, greater than a predetermined value and/or a predetermined minimum are met. Even a minimum satisfied safety standard of the medical device <b>6</b> can be used as the device identification feature.

If the medical device <b>6</b> complied with the predetermined internal criterion of the removable data storage medium <b>4</b>, then the write protection unit <b>13</b> grants the medical device <b>6</b> read and write access to the non-volatile storage medium <b>10</b>. In all other cases, i.e. when the device identification feature does not comply with the predetermined internal criterion or no device identification feature can be identified, the write protection unit <b>13</b> exclusively ensures read access to the non-volatile storage medium <b>10</b>. This is, for example, the case when an arbitrary computer system is connected to the serial interface <b>9</b><i>a </i>of the removable data storage medium <b>4</b>.

The described allocation of the access rights to the non-volatile storage medium <b>10</b> of the removable data storage medium <b>4</b> prevents data from any computer system from making its way onto different medical devices via the removable data storage medium <b>4</b>, which serves as a transport medium. Thus, the spread of malware on medical devices <b>6</b> can be avoided.

<figref idref="DRAWINGS">FIG. 2</figref> shows a further schematically drawn medical system <b>2</b><i>b </i>according to a further exemplary embodiment. In contrast to the medical system <b>2</b><i>a </i>shown in <figref idref="DRAWINGS">FIG. 1</figref>, the removable data storage medium <b>4</b> with its USB plug <b>8</b> is plugged into the USB socket <b>14</b> of the medical device <b>6</b>.

For transmitting data from the medical device <b>6</b> to the removable data storage medium <b>4</b>, the serial interface <b>9</b><i>a</i>, thus the USB port of the removable data storage medium <b>4</b>, is connected to the corresponding serial interface <b>9</b><i>b </i>of the medical device <b>6</b>, for example thus the USB plug <b>8</b> is plugged into the USB socket <b>14</b> of the medical device <b>6</b>. The removable data storage medium <b>4</b> subsequently receives an application identification feature from the connected medical device <b>6</b> on its receiving unit <b>16</b>.

In the exemplary embodiment shown in <figref idref="DRAWINGS">FIG. 2</figref>, the transmission of the device identification feature from the medical device <b>6</b> to the removable data storage medium <b>4</b> takes place with the help of an optical data link. For this purpose, the removable data storage medium <b>4</b> comprises a photodiode <b>24</b>. It receives the signals of a light emitter, such as an infrared light-emitting diode <b>26</b>, which is integrated into the medical device <b>6</b> as a transmitting unit <b>20</b>.

After receiving the device identification feature, the write protection unit <b>13</b> of the removable data storage medium <b>4</b> compares the received device identification feature with an internal criterion. Read/write access to the non-volatile storage medium <b>10</b> is subsequently established if the device identification feature of the medical device <b>6</b> complies with the criterion. If this is not the case, then the access to the non-volatile storage medium <b>10</b> is restricted to read access only.

Further details regarding the functionality of the removable data storage medium <b>4</b> and of the medical device <b>6</b> were already explained when making reference to the exemplary embodiment shown in <figref idref="DRAWINGS">FIG. 1</figref>.

For transmitting the device identification feature, the infrared light-emitting diode <b>26</b> and the photodiode <b>24</b> of the medical device <b>6</b> and of the removable data storage medium <b>4</b>, respectively, are arranged opposite each other. This is applicable when the removable data storage medium <b>4</b> is connected to the medical device <b>6</b> (as shown schematically in <figref idref="DRAWINGS">FIG. 2</figref>). The transmitting unit <b>20</b> and the receiving unit <b>16</b> of the medical device <b>6</b> of the removable data storage medium <b>4</b> can lie opposite each other when the USB plug <b>8</b> of the removable data storage medium <b>4</b> is plugged into the USB socket <b>14</b> of the medical device <b>6</b>. According to a further exemplary embodiment (not shown), the transmitting unit <b>20</b> and the receiving unit <b>16</b> are directly integrated into a specially shaped USB plug <b>6</b> and USB socket <b>14</b>, respectively.

<figref idref="DRAWINGS">FIG. 3</figref> shows a further medical system <b>2</b><i>c </i>in a schematic representation. The removable data storage medium <b>4</b> already described in detail in connection with <figref idref="DRAWINGS">FIGS. 1 and 2</figref> and the medical device <b>6</b> are equipped with a transmitting and receiving unit <b>20</b>, <b>16</b>, respectively, in the shown exemplary embodiment, which is mechanically encoded.

The transmitting unit <b>20</b> and the receiving unit <b>16</b> are encoded complementary mechanically and interact similar to a key-and-lock principle. For example, the removable data storage medium <b>4</b> is provided with a pin <b>28</b> of a certain length. It works together with an additional pin <b>30</b>, which is located in a medical device <b>6</b>. If both pins <b>28</b>, <b>30</b> have a suitable length, in other words if they add up to a predetermined length, then a position sensor <b>34</b> present within the removable data storage medium <b>4</b> (not shown in greater detail in <figref idref="DRAWINGS">FIG. 3</figref>), for example a micro switch, is activated, the switch position of which specifies that the medical device <b>6</b> is a qualified medical device <b>6</b>. If the lengths of both pins <b>28</b>, <b>30</b> are not coordinated, then there is no release.

According to a further exemplary embodiment, the pin <b>28</b> present on the removable data storage medium <b>4</b> is provided with a characteristic shape on its tip facing the medical device <b>6</b>. In interaction with a complementary counter shape, which is located on the additional pin <b>30</b>, which is connected to the medical device <b>6</b>, the suitable length of both pins <b>28</b>, <b>30</b> is configured in that the position sensor <b>34</b> is reactivated.

For example, if the mechanically encoded shape of the pin <b>28</b> does not fit the counter shape of the additional pin <b>30</b>, then it enters too deeply or not deeply enough into the recess <b>32</b> present in the medical device <b>6</b> and the position sensor <b>34</b> is not activated.

The pin <b>28</b> present on the removable data storage medium <b>4</b> forms a mechanical receiving unit <b>16</b> to this effect, and the additional pin <b>30</b> present on the medical device <b>6</b> also forms a mechanical transmitting unit <b>20</b> to this effect. Only if the pin <b>28</b> is located in the correct position when the removable data storage medium <b>4</b> is plugged in is full access (read and write access) to the non-volatile storage medium <b>10</b> granted by the write protection unit <b>13</b> present in the memory controller <b>12</b>.

<figref idref="DRAWINGS">FIG. 4</figref> shows a schematic flow chart of a method for operating a removable data storage medium <b>4</b>. The method starts in step S<b>1</b>. The serial interface <b>9</b><i>a </i>of the removable data storage medium <b>4</b> is subsequently connected to the serial interface <b>9</b><i>b </i>of the medical device <b>6</b> (step S<b>2</b>). The removable data storage medium <b>4</b> subsequently receives an application identification feature from the connected medical device <b>6</b> on the receiving unit <b>16</b> (step S<b>3</b>). The steps S<b>2</b> and S<b>3</b> do not need to be performed in the sequence shown in <figref idref="DRAWINGS">FIG. 3</figref>. According to a further exemplary embodiment, it is also possible that the application identification feature is received before the serial interfaces <b>9</b><i>a</i>, <b>9</b><i>b </i>of the removable data storage medium <b>4</b> and of the medical device <b>6</b> are interconnected. This case is possible when the device identification feature is transmitted via a wireless data link <b>19</b>.

The device identification feature is subsequently compared with a predetermined internal criterion (step S<b>4</b>). If this comparison is successful, then read and write access to the non-volatile storage medium <b>10</b> of the removable data storage medium <b>4</b> is set up (step S<b>5</b>). In all other cases, i.e. if the device identification feature does not comply with the predetermined criterion or a device identification feature cannot be identified, access to the non-volatile storage medium <b>10</b> is restricted to read access (step S<b>6</b>). The method finally ends in step S<b>7</b>.

<figref idref="DRAWINGS">FIG. 5<i>a </i></figref>schematically shows the communication of a removable data storage medium <b>4</b> according to the prior art with any computer system <b>36</b> on one side and with a medical device in a medical system <b>2</b> on the other side. The double arrow shown in <figref idref="DRAWINGS">FIG. 5<i>a </i></figref>between the removable data storage medium <b>4</b> and the computer system <b>36</b> indicates full access to the removable data storage medium <b>4</b>, i.e. read and write access to its non-volatile storage medium <b>10</b>. The removable data storage medium <b>4</b> also communicates with the medical device <b>6</b> with full access. As can be seen in <figref idref="DRAWINGS">FIG. 5<i>a</i></figref>, malware from the computer system <b>36</b> can get into the medical device <b>6</b>.

In contrast, as shown schematically in <figref idref="DRAWINGS">FIG. 5<i>b</i></figref>, access from any computer system <b>36</b> to a removable data storage medium <b>4</b> according to an exemplary embodiment of the invention is restricted to read access. This is indicated by the arrow pointing from the removable data storage medium <b>4</b> in the direction of the computer system <b>36</b>. Data transmission in the opposite direction, i.e. from the computer system <b>36</b> to the removable data storage medium <b>4</b>, is not possible. Only in communication with a qualified medical device <b>6</b>, which is qualified based on its device identification feature, which complies with the predetermined internal criterion of the removable data storage medium <b>4</b>, full access indicated by a double arrow (read and write access) is possible.

Thus, communication between respectively qualified medical devices <b>6</b> is possible with the help of the removable data storage medium <b>4</b> without restrictions. At the same time, the data security in this internal system compared to known solutions is considerably increased.

While there has been shown and described what is considered to be preferred embodiments of the invention, it will, of course, be understood that various modifications and changes in form or detail could readily be made without departing from the spirit of the invention. It is therefore intended that the invention be not limited to the exact forms described and illustrated, but should be constructed to cover all modifications that may fall within the scope of the appended claims.

REFERENCE LIST

<ul id="ul0001" list-style="none"><li id="ul0001-0001" num="0080"><b>2</b><i>a</i>, <b>2</b><i>b</i>, <b>2</b><i>c </i>Medical system</li><li id="ul0001-0002" num="0081"><b>4</b> Removable data storage medium</li><li id="ul0001-0003" num="0082"><b>6</b> Medical device</li><li id="ul0001-0004" num="0083"><b>8</b> USB plug</li><li id="ul0001-0005" num="0084"><b>9</b><i>a</i>, <b>9</b><i>b </i>Serial interface</li><li id="ul0001-0006" num="0085"><b>10</b> Non-volatile storage medium</li><li id="ul0001-0007" num="0086"><b>12</b> Memory controller</li><li id="ul0001-0008" num="0087"><b>13</b> Write protection unit</li><li id="ul0001-0009" num="0088"><b>14</b> USB socket</li><li id="ul0001-0010" num="0089"><b>16</b> Receiving unit</li><li id="ul0001-0011" num="0090"><b>18</b> RFID transponder</li><li id="ul0001-0012" num="0091"><b>19</b> Wireless data link</li><li id="ul0001-0013" num="0092"><b>20</b> Transmitting unit</li><li id="ul0001-0014" num="0093"><b>22</b> RFID tag</li><li id="ul0001-0015" num="0094"><b>24</b> Photodiode</li><li id="ul0001-0016" num="0095"><b>26</b> Infrared light-emitting diode</li><li id="ul0001-0017" num="0096"><b>28</b> Pin</li><li id="ul0001-0018" num="0097"><b>30</b> Additional pin</li><li id="ul0001-0019" num="0098"><b>32</b> Recess</li><li id="ul0001-0020" num="0099"><b>34</b> Position sensor</li><li id="ul0001-0021" num="0100"><b>36</b> Computer system</li></ul>